1275813 - Crash in base::win::PEImage::GetProcOrdinal

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

This bug was filed from the Socorro interface and is 
report bp-f70bf987-aff5-4f16-b9ee-c60a32160525.
=============================================================

Comment 1

[Bob Owen (:bobowen)]

I suspect this might be a similar underlying issue to bug 1271890.

Although this one appears to happen (but not as often) on x86 as well, which bug 1271890 doesn't.

Comment 2

[Bob Owen (:bobowen)]

Maybe this is different, all apart from one seem to have these DLLs:
cyinjct.dll
cyvrtrap.dll
cyvera.dll 

Cyvera is now owned by Palo Alto Networks - https://www.paloaltonetworks.com/

It is also not in the code path where we differ from Chrome because of having a different child executable.

Comment 3

[Bob Owen (:bobowen)]

This is probably the product, if it turns out to be down to those DLLs:
https://www.paloaltonetworks.com/products/secure-the-endpoint/traps

Comment 4

[Bob Owen (:bobowen)]

Hi, looks like you are (or at least were) from Palo Alto Networks and Cyvera.

This issue might be down to an interaction with one of your security products.

It would be great if you could help or give us a contact for someone who can.

Thanks,
Bob

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'base::win::PEImage::GetProcOrdinal':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 4 crashes from 2016-06-06.
 - release (version 47): 9 crashes from 2016-05-31.
 - esr     (version 45): 23 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           0          0          0          0          0          0          0
 - beta             3          0          1          0          0          0          0
 - release          0          0          3          2          1          1          1
 - esr              2          1          2          4          0          5          6

Affected platform: Windows

Comment 6

[Bob Owen (:bobowen)]

While this wasn't as common as bug 1271890, we've not seen this since Fx50 either.
So I think we can say this was resolved by bug 1287426 as well.